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EXAMINER'S AMENDMENT 

1 . An examiner's amendment to the record appears below. Should the changes 
and/or additions be unacceptable to applicant, an amendment may be filed as provided 
by 37 CFR 1 .312. To ensure consideration of such an amendment, it MUST be 
submitted no later than the payment of the issue fee. 
The application has been amended as follows: 

Please amend the title to read: Fragment Processing using Cross-Linked Tables 



REASONS FOR ALLOWANCE 

1 . The following is an examiner's statement of reasons for allowance: The prior art 
of record does not provide for, nor suggests providing for a system located in a 
firewalling device which stores received fragments in association with the packet and in 
order in a connection table and a network address translation table, cross linking the NT 
and CT by storing a hash of at least a portion of the fragments in the NT and CT tables, 
reassembling the fragments, storing an address research table for a first packet of a 
connection in association with the NT and CT and hashing each of the subsequent 
packets to determine a table entry to forward the packet and then transferring the 
packet to the firewalling device to apply firewall policies to the entire packet at one time. 
Rather than having one large state table for Connection table 600 and NAT table 700 
information, two linked state tables are used to conserve memory. The NT is enabled to 
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allow Network Address translation in the firewalling device, and the CT is used for 
tracking TCP state. Indicies are computed for each CT and NT entry and an ART index 
is stored in each of the NT tables and CT tables for each entry. Indicies are computed 
by hashing the five-tuple entry. Each NT entry is cross-linked with a corresponding CT 
entry, and each CT entry is cross-linked with a corresponding NT entry. CT and NT 
each store links to ART table via an Art index 601 . ART table stores information 
associated with delivery of packet 101 such as MAC address and other MAC-layer 
attributes like MAC Address, VLAN ID, and an Interface Mask. Figures 6-8 show the 
format of a CT entry, an NT entry, and an ART entry. Each CT and NT index has an 
ART index 601 , and the CT entry holds information regarding the TCP state of the 
connection. NT index holds information regarding address translation. Each has an 
index to the other table 606 and 706, to thereby save computation power by following 
the index rather than computing another hash value to the other tables. For these 
reasons, in conjunction with the other limitations of the independent claims, puts this 
case in condition for allowance. 

Any comments considered necessary by applicant must be submitted no later 
than the payment of the issue fee and, to avoid processing delays, should preferably 
accompany the issue fee. Such submissions should be clearly labeled "Comments on 
Statement of Reasons for Allowance." 
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2. The IDS dated August 28, 2007 has been considered. See enclosed PTO-1449. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Joseph E. Avellino whose telephone number is (571 ) 
272-3905. The examiner can normally be reached on Monday-Friday 7:00-4:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, David A. Wiley can be reached on (571 ) 272-3923. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-780^9199 (IN USA OR CANADA) or 571-272-1000. 




Joseph E. Avellino, Examiner 
November 1 9, 2007 



